CVE-2026-1571

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
TP-Link Systems Inc.Archer C60 v3< V3_260206

References

Timeline

Published
Feb 11, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-157106.8An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R14CVE-2026-157117.5A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6CVE-2026-157125.9A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. WheCVE-2026-157135.9A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under spCVE-2026-157146.5An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_streaCVE-2026-157154.3A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functioCVE-2026-157184.3We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability CVE-2026-157195.4We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability CVE-2026-15726.4The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting viCVE-2026-157208.6In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscCVE-2026-157219.8Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human ResourcesCVE-2026-157227.5A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copie